Track image-size audit exception

[jongan69]

The Bun audit reports GHSA-w3rx-r6r6-pgpr and GHSA-5p2g-fcmc-qvqq in Expo and React Native's Metro build-tooling path. The registry currently exposes image-size 2.0.2 as the latest release, and both advisories affect <=2.0.2. The shipped app runtime does not expose Metro's local asset inspection to users.

Disposition: time-limited accepted exception through 2026-09-30. CI must fail if the exact advisory set changes or any other high/critical finding appears.

Acceptance:

• Upgrade after a patched image-size release and compatible Metro call sites exist.
• Re-run Expo Doctor, app/Worker checks, and Android export.
• Remove the exception before its expiry.